abnormally_high_number_of_cloud_infrastructure_api_calls: cim_version: 5.0.1 supported_tas: - Splunk_TA_aws-kinesis-firehose tas_with_cim_mapping: - Splunk_TA_juniper - Splunk_TA_ossec - Splunk_TA_citrix-netscaler - Splunk_TA_nix - Splunk_TA_cyberark - Splunk_TA_salesforce - Splunk_TA_rsa_securid_cas - Splunk_TA_box - splunk_ta_o365 - Splunk_TA_rsa-securid - Splunk_TA_cisco-asa - Splunk_TA_aws-kinesis-firehose - Splunk_TA_infoblox abnormally_high_number_of_cloud_security_group_api_calls: cim_version: 5.0.1 supported_tas: - Splunk_TA_aws-kinesis-firehose tas_with_cim_mapping: - Splunk_TA_juniper - Splunk_TA_ossec - Splunk_TA_citrix-netscaler - Splunk_TA_nix - Splunk_TA_cyberark - Splunk_TA_salesforce - Splunk_TA_rsa_securid_cas - Splunk_TA_box - splunk_ta_o365 - Splunk_TA_rsa-securid - Splunk_TA_cisco-asa - Splunk_TA_aws-kinesis-firehose - Splunk_TA_infoblox account_discovery_with_net_app: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon active_setup_registry_autostart: cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack add_defaultuser_and_password_in_registry: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack add_or_set_windows_defender_exclusion: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon allow_file_and_printing_sharing_in_firewall: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon allow_network_discovery_in_firewall: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon allow_operation_with_consent_admin: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack anomalous_usage_of_7zip: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_windows any_powershell_downloadfile: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon any_powershell_downloadstring: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon attacker_tools_on_endpoint: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_windows attempt_to_add_certificate_to_untrusted_store: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_windows attempt_to_stop_security_service: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon attempted_credential_dump_from_registry_via_reg_exe: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon auto_admin_logon_registry_entry: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack batch_file_write_to_system32: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_nix - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR bcdedit_command_back_to_normal_mode_boot: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_windows bcdedit_failure_recovery_modification: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR bits_job_persistence: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon bitsadmin_download_file: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon certutil_download_with_urlcache_and_split_arguments: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon certutil_download_with_verifyctl_and_split_arguments: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon certutil_exe_certificate_extraction: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon certutil_with_decode_argument: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon change_default_file_association: cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack change_to_safe_mode_with_network_config: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_windows check_elevated_cmd_using_whoami: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_windows clear_unallocated_sector_using_cipher_app: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon clop_common_exec_parameter: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon cloud_api_calls_from_previously_unseen_user_roles: cim_version: 5.0.1 supported_tas: - Splunk_TA_aws-kinesis-firehose tas_with_cim_mapping: - Splunk_TA_salesforce - Splunk_TA_rsa_securid_cas - Splunk_TA_box - splunk_ta_o365 - Splunk_TA_aws-kinesis-firehose - Splunk_TA_infoblox cloud_compute_instance_created_by_previously_unseen_user: cim_version: 5.0.1 supported_tas: - Splunk_TA_aws-kinesis-firehose tas_with_cim_mapping: - Splunk_TA_aws-kinesis-firehose cloud_compute_instance_created_in_previously_unused_region: cim_version: 5.0.1 supported_tas: - Splunk_TA_aws-kinesis-firehose tas_with_cim_mapping: - Splunk_TA_aws-kinesis-firehose cloud_instance_modified_with_previously_unseen_user: cim_version: 5.0.1 supported_tas: - Splunk_TA_aws-kinesis-firehose tas_with_cim_mapping: - Splunk_TA_juniper - Splunk_TA_ossec - Splunk_TA_citrix-netscaler - Splunk_TA_nix - Splunk_TA_cyberark - Splunk_TA_salesforce - Splunk_TA_rsa_securid_cas - Splunk_TA_box - splunk_ta_o365 - Splunk_TA_rsa-securid - Splunk_TA_aws-kinesis-firehose cloud_provisioning_from_previously_unseen_city: cim_version: 5.0.1 supported_tas: - Splunk_TA_aws-kinesis-firehose tas_with_cim_mapping: - Splunk_TA_juniper - Splunk_TA_citrix-netscaler - Splunk_TA_cyberark - Splunk_TA_salesforce - Splunk_TA_rsa_securid_cas - Splunk_TA_box - splunk_ta_o365 - Splunk_TA_rsa-securid - Splunk_TA_cisco-asa - Splunk_TA_aws-kinesis-firehose - Splunk_TA_infoblox cloud_provisioning_from_previously_unseen_country: cim_version: 5.0.1 supported_tas: - Splunk_TA_aws-kinesis-firehose tas_with_cim_mapping: - Splunk_TA_juniper - Splunk_TA_citrix-netscaler - Splunk_TA_cyberark - Splunk_TA_salesforce - Splunk_TA_rsa_securid_cas - Splunk_TA_box - splunk_ta_o365 - Splunk_TA_rsa-securid - Splunk_TA_cisco-asa - Splunk_TA_aws-kinesis-firehose - Splunk_TA_infoblox cloud_provisioning_from_previously_unseen_ip_address: cim_version: 5.0.1 supported_tas: - Splunk_TA_aws-kinesis-firehose tas_with_cim_mapping: - Splunk_TA_juniper - Splunk_TA_citrix-netscaler - Splunk_TA_cyberark - Splunk_TA_salesforce - Splunk_TA_rsa_securid_cas - Splunk_TA_box - splunk_ta_o365 - Splunk_TA_rsa-securid - Splunk_TA_aws-kinesis-firehose cloud_provisioning_from_previously_unseen_region: cim_version: 5.0.1 supported_tas: - Splunk_TA_aws-kinesis-firehose tas_with_cim_mapping: - Splunk_TA_juniper - Splunk_TA_citrix-netscaler - Splunk_TA_cyberark - Splunk_TA_salesforce - Splunk_TA_rsa_securid_cas - Splunk_TA_box - splunk_ta_o365 - Splunk_TA_rsa-securid - Splunk_TA_cisco-asa - Splunk_TA_aws-kinesis-firehose - Splunk_TA_infoblox cmd_echo_pipe___escalation: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon cmdline_tool_not_executed_in_cmd_shell: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon conti_common_exec_parameter: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon control_loading_from_world_writable_directory: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon create_local_admin_accounts_using_net_exe: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon create_or_delete_windows_shares_using_net_exe: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon creation_of_shadow_copy: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon creation_of_shadow_copy_with_wmic_and_powershell: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon credential_dumping_via_copy_command_from_shadow_copy: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon credential_dumping_via_symlink_to_shadow_copy: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon curl_download_and_bash_execution: cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_windows deleting_of_net_users: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon deleting_shadow_copies: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon detect_azurehound_command_line_arguments: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon detect_exchange_web_shell: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_CrowdStrike_FDR detect_html_help_spawn_child_process: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon detect_html_help_url_in_command_line: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon detect_html_help_using_infotech_storage_handlers: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon detect_mshta_inline_hta_execution: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon detect_mshta_url_in_command_line: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon detect_path_interception_by_creation_of_program_exe: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon detect_processes_used_for_system_network_configuration_discovery: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon detect_psexec_with_accepteula_flag: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon detect_rclone_command_line_usage: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon detect_regasm_spawning_a_process: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_windows detect_regasm_with_no_command_line_arguments: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon detect_regsvcs_spawning_a_process: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_windows detect_regsvcs_with_no_command_line_arguments: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon detect_regsvr32_application_control_bypass: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon detect_rundll32_application_control_bypass___advpack: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon detect_rundll32_application_control_bypass___setupapi: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon detect_rundll32_application_control_bypass___syssetup: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon detect_rundll32_inline_hta_execution: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon detect_sharphound_command_line_arguments: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_windows detect_sharphound_usage: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon detect_use_of_cmd_exe_to_launch_script_interpreters: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_windows disable_amsi_through_registry: cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack disable_etw_through_registry: cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack disable_logs_using_wevtutil: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack disable_registry_tool: cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack disable_schedule_task: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR disable_windows_app_hotkeys: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack disable_windows_behavior_monitoring: cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack disabling_cmd_application: cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack disabling_controlpanel: cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack disabling_firewall_with_netsh: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon disabling_folderoptions_windows_feature: cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack disabling_net_user_account: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon disabling_norun_windows_app: cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack disabling_remote_user_account_control: cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack disabling_systemrestore_in_registry: cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack disabling_task_manager: cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack dns_exfiltration_using_nslookup_app: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon dns_query_length_with_high_standard_deviation: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_isc-bind - Splunk_TA_CrowdStrike_FDR - Splunk_TA_infoblox domain_account_discovery_with_net_app: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_windows domain_account_discovery_with_wmic: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_windows domain_controller_discovery_with_nltest: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon dsquery_domain_discovery: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR dump_lsass_via_comsvcs_dll: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon dump_lsass_via_procdump: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR elevated_group_discovery_with_net: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon elevated_group_discovery_with_wmic: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon enable_rdp_in_other_port_number: cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack eventvwr_uac_bypass: cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack excel_spawning_powershell: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon excessive_attempt_to_disable_services: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR excessive_distinct_processes_from_windows_temp: cim_version: 5.0.1 supported_tas: - Splunk_TA_windows tas_with_cim_mapping: - Splunk_TA_nix - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_windows - Splunk_TA_cyberark_epm - Splunk_TA_CrowdStrike_FDR excessive_number_of_service_control_start_as_disabled: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_windows excessive_number_of_taskhost_processes: cim_version: 5.0.1 supported_tas: - Splunk_TA_windows tas_with_cim_mapping: - Splunk_TA_nix - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR excessive_service_stop_attempt: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon excessive_usage_of_cacls_app: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR excessive_usage_of_net_app: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon excessive_usage_of_taskkill: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR executables_or_script_creation_in_suspicious_path: cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_CrowdStrike_FDR execute_javascript_with_jscript_com_clsid: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_windows execution_of_file_with_multiple_extensions: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_windows extraction_of_registry_hives: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon f5_big_ip_icontrol_rest_vulnerability_cve_2022_1388: cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_squid - Splunk_TA_citrix-netscaler - Splunk_TA_cisco-wsa - Splunk_TA_mcafee-wg - Splunk_TA_haproxy - Splunk_TA_websense-cg - Splunk_TA_microsoft-iis - Splunk_TA_nginx file_with_samsam_extension: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_nix - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_cyberark - Splunk_TA_sophos - Splunk_TA_windows - splunk_ta_o365 - Splunk_TA_CrowdStrike_FDR firewall_allowed_program_enable: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_windows fodhelper_uac_bypass: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_windows fsutil_zeroing_file: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_windows get_aduserresultantpasswordpolicy_with_powershell: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_windows get_domainpolicy_with_powershell: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_windows get_domaintrust_with_powershell: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon get_domainuser_with_powershell: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_windows get_foresttrust_with_powershell: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon getdomaincomputer_with_powershell: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon getdomaingroup_with_powershell: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon getwmiobject_ds_computer_with_powershell: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon getwmiobject_ds_group_with_powershell: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon getwmiobject_ds_user_with_powershell: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_windows hide_user_account_from_sign_in_screen: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack hiding_files_and_directories_with_attrib_exe: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_windows icacls_deny_command: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR icacls_grant_command: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR impacket_lateral_movement_commandline_parameters: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon java_class_file_download_by_java_user_agent: cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_squid - Splunk_TA_citrix-netscaler - Splunk_TA_cisco-wsa - Splunk_TA_mcafee-wg - Splunk_TA_haproxy - Splunk_TA_websense-cg - Splunk_TA_microsoft-iis - Splunk_TA_nginx jscript_execution_using_cscript_app: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_windows linux_account_manipulation_of_ssh_config_and_keys: cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack linux_add_files_in_known_crontab_directories: cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack linux_at_allow_config_file_creation: cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack linux_at_application_execution: cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR linux_change_file_owner_to_root: cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR linux_clipboard_data_copy: cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon linux_dd_file_overwrite: cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR linux_decode_base64_to_shell: cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon linux_deleting_critical_directory_using_rm_command: cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR linux_deletion_of_cron_jobs: cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack linux_deletion_of_init_daemon_script: cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack linux_deletion_of_services: cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack linux_deletion_of_ssl_certificate: cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack linux_disable_services: cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR linux_doas_conf_file_creation: cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack linux_doas_tool_execution: cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR linux_file_created_in_kernel_driver_directory: cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack linux_file_creation_in_init_boot_directory: cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack linux_file_creation_in_profile_directory: cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack linux_high_frequency_of_file_deletion_in_boot_folder: cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack linux_high_frequency_of_file_deletion_in_etc_folder: cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack linux_insert_kernel_module_using_insmod_utility: cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR linux_install_kernel_module_using_modprobe_utility: cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR linux_iptables_firewall_modification: cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR linux_java_spawning_shell: cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon linux_kernel_module_enumeration: cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon linux_nopasswd_entry_in_sudoers_file: cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR linux_obfuscated_files_or_information_base64_decode: cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon linux_pkexec_privilege_escalation: cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon linux_possible_access_or_modification_of_sshd_config_file: cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR linux_possible_access_to_credential_files: cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR linux_possible_access_to_sudoers_file: cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR linux_possible_append_command_to_at_allow_config_file: cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR linux_possible_append_command_to_profile_config_file: cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR linux_possible_ssh_key_file_creation: cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack linux_preload_hijack_library_calls: cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR linux_service_file_created_in_systemd_directory: cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack linux_service_restarted: cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR linux_service_started_or_enabled: cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR linux_setuid_using_chmod_utility: cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR linux_setuid_using_setcap_utility: cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR linux_shred_overwrite_command: cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR linux_ssh_authorized_keys_modification: cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon linux_ssh_remote_services_script_execute: cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon linux_stop_services: cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR linux_sudoers_tmp_file_creation: cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack linux_system_network_discovery: cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR linux_visudo_utility_execution: cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR log4shell_jndi_payload_injection_attempt: cim_version: 5.0.1 supported_tas: - Splunk_TA_nginx tas_with_cim_mapping: - Splunk_TA_nginx logon_script_event_trigger_execution: cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack malicious_powershell_process___execution_policy_bypass: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon malicious_powershell_process_with_obfuscation_techniques: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon mimikatz_passtheticket_commandline_parameters: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_windows mmc_exe_lolbas_execution_process_spawn: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon modify_acl_permission_to_files_or_folder: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR monitor_registry_keys_for_print_monitors: cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack msbuild_suspicious_spawned_by_script_process: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon mshta_spawning_rundll32_or_regsvr32_process: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon msmpeng_application_dll_side_loading: cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_CrowdStrike_FDR net_profiler_uac_bypass: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack nishang_powershelltcponeline: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon nltest_domain_trust_discovery: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_windows ntdsutil_export_ntds: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_windows office_application_spawn_regsvr32_process: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon office_application_spawn_rundll32_process: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon office_document_spawned_child_process_to_download: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon office_product_spawn_cmd_process: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon office_product_spawning_bitsadmin: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon office_product_spawning_certutil: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon office_product_spawning_mshta: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon office_product_spawning_rundll32_with_no_dll: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon office_product_spawning_wmic: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon office_spawning_control: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon overwriting_accessibility_binaries: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_ossec - Splunk_TA_nix - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_cyberark - Splunk_TA_sophos - Splunk_TA_windows - splunk_ta_o365 - Splunk_TA_CrowdStrike_FDR permission_modification_using_takeown_app: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack ping_sleep_batch_command: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon possible_lateral_movement_powershell_spawn: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon potentially_malicious_code_on_commandline: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_windows powershell_disable_security_monitoring: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon powershell_start_bitstransfer: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon prevent_automatic_repair_mode_using_bcdedit: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack print_processor_registry_autostart: cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack process_creating_lnk_file_in_suspicious_location: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_CrowdStrike_FDR process_execution_via_wmi: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR process_kill_base_on_file_path: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon processes_launching_netsh: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_windows recursive_delete_of_directory_in_batch_cmd: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon reg_exe_manipulating_windows_services_registry_keys: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR registry_keys_for_creating_shim_databases: cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack registry_keys_used_for_persistence: cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack registry_keys_used_for_privilege_escalation: cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack regsvr32_silent_and_install_param_dll_loading: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon regsvr32_with_known_silent_switch_cmdline: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon remote_process_instantiation_via_dcom_and_powershell: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon remote_process_instantiation_via_winrm_and_powershell: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon remote_process_instantiation_via_winrm_and_winrs: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon remote_process_instantiation_via_wmi: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon remote_process_instantiation_via_wmi_and_powershell: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon remote_system_discovery_with_wmic: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon remote_wmi_command_attempt: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_windows resize_shadowstorage_volume: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_windows revil_common_exec_parameter: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack revil_registry_entry: cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack rubeus_command_line_parameters: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_windows rundll32_control_rundll_world_writable_directory: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon rundll32_lockworkstation: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_windows rundll32_shimcache_flush: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon rundll32_with_no_command_line_arguments_with_network: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon rundll_loading_dll_by_ordinal: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon ryuk_test_files_detected: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_nix - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_cyberark - Splunk_TA_sophos - Splunk_TA_windows - splunk_ta_o365 - Splunk_TA_CrowdStrike_FDR ryuk_wake_on_lan_command: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_windows samsam_test_file_write: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_nix - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_cyberark - Splunk_TA_sophos - Splunk_TA_windows - splunk_ta_o365 - Splunk_TA_CrowdStrike_FDR sc_exe_manipulating_windows_services: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR scheduled_task_creation_on_remote_endpoint_using_at: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon scheduled_task_deleted_or_created_via_cmd: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_windows scheduled_task_initiation_on_remote_endpoint: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon schtasks_run_task_on_demand: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR schtasks_scheduling_job_on_remote_system: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR schtasks_used_for_forcing_a_reboot: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR screensaver_event_trigger_execution: cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack script_execution_via_wmi: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_nix - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_windows - Splunk_TA_cyberark_epm - Splunk_TA_CrowdStrike_FDR sdclt_uac_bypass: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack sdelete_application_execution: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon secretdumps_offline_ntds_dumping_tool: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack serviceprincipalnames_discovery_with_setspn: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon services_escalate_exe: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_windows services_exe_lolbas_execution_process_spawn: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon set_default_powershell_execution_policy_to_unrestricted_or_bypass: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack shim_database_file_creation: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_ossec - Splunk_TA_nix - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_CrowdStrike_FDR shim_database_installation_with_suspicious_parameters: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR short_lived_windows_accounts: cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_cyberark - Splunk_TA_microsoft-cloudservices - Splunk_TA_rsa-securid - Splunk_TA_aws-kinesis-firehose silentcleanup_uac_bypass: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack single_letter_process_on_endpoint: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_nix - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_windows - Splunk_TA_cyberark_epm - Splunk_TA_CrowdStrike_FDR slui_runas_elevated: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_windows slui_spawning_a_process: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_windows spoolsv_spawning_rundll32: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon spoolsv_writing_a_dll: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_nix - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_CrowdStrike_FDR spring4shell_payload_url_request: cim_version: 5.0.1 supported_tas: - Splunk_TA_nginx tas_with_cim_mapping: - Splunk_TA_squid - Splunk_TA_citrix-netscaler - Splunk_TA_cisco-wsa - Splunk_TA_mcafee-wg - Splunk_TA_haproxy - Splunk_TA_websense-cg - Splunk_TA_microsoft-iis - Splunk_TA_nginx suspicious_copy_on_system32: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon suspicious_dllhost_no_command_line_arguments: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon suspicious_gpupdate_no_command_line_arguments: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon suspicious_icedid_rundll32_cmdline: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon suspicious_linux_discovery_commands: cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR suspicious_microsoft_workflow_compiler_usage: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon suspicious_msbuild_path: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon suspicious_msbuild_spawn: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon suspicious_mshta_child_process: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_windows suspicious_mshta_spawn: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon suspicious_process_file_path: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_windows suspicious_reg_exe_process: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR suspicious_regsvr32_register_suspicious_path: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon suspicious_rundll32_dllregisterserver: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon suspicious_rundll32_plugininit: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon suspicious_rundll32_startw: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon suspicious_rundll32_with_no_command_line_arguments: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon suspicious_scheduled_task_from_public_directory: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_windows suspicious_searchprotocolhost_no_command_line_arguments: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon suspicious_wevtutil_usage: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR suspicious_writes_to_windows_recycle_bin: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_CrowdStrike_FDR svchost_exe_lolbas_execution_process_spawn: cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon system_information_discovery_detection: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_nix - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_windows - Splunk_TA_cyberark_epm - Splunk_TA_CrowdStrike_FDR system_processes_run_from_unexpected_locations: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_CrowdStrike_FDR time_provider_persistence_registry: cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack unified_messaging_service_spawning_a_process: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_windows uninstall_app_using_msiexec: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_windows unload_sysmon_filter_driver: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR usn_journal_deletion: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_windows vbscript_execution_using_wscript_app: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon vmware_workspace_one_freemarker_server_side_template_injection: cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_squid - Splunk_TA_citrix-netscaler - Splunk_TA_cisco-wsa - Splunk_TA_mcafee-wg - Splunk_TA_haproxy - Splunk_TA_websense-cg - Splunk_TA_microsoft-iis - Splunk_TA_nginx w3wp_spawning_shell: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon wbadmin_delete_system_backups: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR web_jsp_request_via_url: cim_version: 5.0.1 supported_tas: - Splunk_TA_nginx tas_with_cim_mapping: - Splunk_TA_squid - Splunk_TA_citrix-netscaler - Splunk_TA_cisco-wsa - Splunk_TA_mcafee-wg - Splunk_TA_haproxy - Splunk_TA_websense-cg - Splunk_TA_microsoft-iis - Splunk_TA_nginx web_spring_cloud_function_functionrouter: cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_squid - Splunk_TA_citrix-netscaler - Splunk_TA_cisco-wsa - Splunk_TA_mcafee-wg - Splunk_TA_haproxy - Splunk_TA_websense-cg - Splunk_TA_microsoft-iis - Splunk_TA_nginx wermgr_process_spawned_cmd_or_powershell_process: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon wget_download_and_bash_execution: cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_windows windows_adfind_exe: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_windows windows_binary_proxy_execution_mavinject_dll_injection: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon windows_command_and_scripting_interpreter_path_traversal_exec: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon windows_command_shell_dcrat_forkbomb_payload: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon windows_curl_download_to_suspicious_path: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon windows_curl_upload_to_remote_destination: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon windows_deleted_registry_by_a_non_critical_process_file_path: cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack windows_disable_change_password_through_registry: cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack windows_disable_lock_workstation_feature_through_registry: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack windows_disable_logoff_button_through_registry: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack windows_disable_memory_crash_dump: cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack windows_disable_shutdown_button_through_registry: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack windows_disable_windows_group_policy_features_through_registry: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack windows_disableantispyware_reg: cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack windows_dism_remove_defender: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon windows_dotnet_binary_in_non_standard_path: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon windows_execute_arbitrary_commands_with_msdt: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon windows_file_without_extension_in_critical_folder: cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack windows_hide_notification_features_through_registry: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack windows_impair_defense_delete_win_defender_profile_registry: cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack windows_impair_defense_deny_security_software_with_applocker: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon windows_impair_defenses_disable_win_defender_auto_logging: cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack windows_indirect_command_execution_via_forfiles: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_windows windows_indirect_command_execution_via_pcalua: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_windows windows_installutil_credential_theft: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon windows_installutil_in_non_standard_path: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon windows_installutil_uninstall_option: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon windows_installutil_url_in_command_line: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon windows_modify_registry_disable_toast_notifications: cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack windows_modify_registry_disable_win_defender_raw_write_notif: cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack windows_modify_registry_disable_windows_security_center_notif: cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack windows_modify_registry_disabling_wer_settings: cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack windows_modify_registry_disallow_windows_app: cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack windows_modify_registry_regedit_silent_reg_import: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon windows_modify_registry_suppress_win_defender_notif: cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack windows_modify_show_compress_color_and_info_tip_registry: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack windows_mof_event_triggered_execution_via_wmi: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon windows_msiexec_dllregisterserver: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon windows_msiexec_remote_download: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon windows_msiexec_spawn_discovery_command: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon windows_msiexec_unregister_dllregisterserver: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon windows_nirsoft_advancedrun: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon windows_odbcconf_load_dll: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon windows_odbcconf_load_response_file: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon windows_office_product_spawning_msdt: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon windows_process_with_namedpipe_commandline: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon windows_processes_killed_by_industroyer2_malware: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon windows_raccine_scheduled_task_deletion: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon windows_rasautou_dll_execution: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon windows_registry_certificate_added: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack windows_registry_delete_task_sd: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack windows_registry_modification_for_safe_mode_persistence: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack windows_remote_access_software_rms_registry: cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack windows_remote_assistance_spawning_process: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon windows_remote_service_rdpwinst_tool_execution: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon windows_remote_services_allow_rdp_in_firewall: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_windows windows_remote_services_allow_remote_assistance: cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack windows_remote_services_rdp_enable: cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack windows_schtasks_create_run_as_system: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon windows_security_account_manager_stopped: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_nix - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_windows - Splunk_TA_cyberark_epm - Splunk_TA_CrowdStrike_FDR windows_service_create_kernel_mode_driver: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon windows_service_creation_on_remote_endpoint: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon windows_service_creation_using_registry_entry: cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack windows_service_initiation_on_remote_endpoint: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon windows_service_stop_by_deletion: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_windows windows_system_logoff_commandline: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon windows_system_reboot_commandline: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon windows_system_shutdown_commandline: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon windows_system_time_discovery_w32tm_delay: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon windows_valid_account_with_never_expires_password: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon winhlp32_spawning_a_process: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon winword_spawning_cmd: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon winword_spawning_powershell: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon wmic_xsl_execution_via_url: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon wmiprsve_exe_lolbas_execution_process_spawn: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon wscript_or_cscript_suspicious_child_process: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon wsmprovhost_exe_lolbas_execution_process_spawn: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon wsreset_uac_bypass: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack xsl_script_execution_with_wmic: cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon - Splunk_TA_bit9-carbonblack - Splunk_TA_windows